In order to identify cyber security related attacks in the the industrial automation and control system, there are components that signal security relevant alarms and events such as failed and successful log-in attempts, password changes, or firmware updates.
Detecting attacks solely from information retrieved from network traffic and IACS components may be sufficient to detect ongoing cyber-attacks. However, in order to detect suspicious activities early on, additional information has to be taken into account, e.g., events generated from card access systems, vacation plans, or presence sensors.
WO 2012/085087 describes an intrusion detection system for an IACS that takes into account context information representative of conditions or constellations beyond the limits of the IACS. The context information includes shift plans describing which work-force individuals should be active on the system, information from the physical access control describing which individuals have local access to different parts of the system and which individuals are physically present where in the system is, approved work orders describing which individuals have permission to perform which functions in the system or configuration switches that describe different use scenarios the system may be in and for which rule sets should be applied.
However, for implementing such a conventional intrusion detection system, significant amount of configuration overhead can be required for engineering the system. As the configuration of the intrusion detection system also depends on devices and software provided by several different vendors, the individual components accessed by the intrusion detection system can vary. The resulting configuration time required to semantically identify and label security events therefore becomes prohibitive.